一种基于字符及解析特征的恶意域名检测方法

A Malicious Domain Detection Approach Based on Character and Resolution Features

恶意域名被广泛应用于远控木马、钓鱼欺诈等网络攻击中,现有方法无法高效、准确地检测恶意域名。根据恶意域名与正常域名在字符组成、生成方法、解析过程等方面的差异,设计了域名的字符统计特征、相似度特征、解析特征,并结合机器学习算法提出了基于字符及解析特征的恶意域名检测方法,实现了自动化特征提取工具。通过对来源于国家互联网应急响应中心(CNCERT)的大量恶意域名进行检测,证实了这些特征在正常域名与恶意域名之间的区分度,在提高检测准确率的同时,降低了特征提取开销。因此,可利用多维度特征和机器学习算法实现恶意域名检测,保障网络安全。

Malicious domain is widely used in phishing and remote control trojan, and there still exist many limitations to detect malicious domain with high efficiency. In the light of the differences between malicious domains and normal domains in characters, generating algorithms, and resolving, a detection approach based on character and resolution features is proposed with the help of machine learning. With the approach applied to a large amount of malicious domains from CNCERT, the effectiveness of discrimination features has been proven. What＇s more, the detection approach improves the accuracy with cost reduced. As a conclusion, multi-dimension features and machine learning algorithms can be used in detection of malicious domains for network security.